Re: [sentinix-list] Webmin + Honeyd

I have a cisco 4006 layer 3 switch...that should be able to do port
spanning..correct? In Sentinix, is Snort configured as just an IDS or a
packet sniffer?





====================================
Marlon Richards
Communications Engineer
West Indies Alumina Company
Kirkvine Works
Jamaica
Tel#:    876-961-7434
Fax#:   876-961-7464
Email:  marlon.richards-Rzeo2xivIqhWk0Htik3J/[email protected]



                                                                           
             Michel Blomgren                                               
             <[email protected]                                             
             org>                                                       To 
             Sent by:                  The SENTINIX Mailing List           
             sentinix-bounces@         <[email protected]>       
             elevenprospect.co                                          cc 
             m                                                             
                                                                   Subject 
                                       Re: [sentinix-list] Webmin + Honeyd 
             12/11/2003 07:34                                              
             PM                                                            
                                                                           
                                                                           
             Please respond to                                             
               The SENTINIX                                                
               Mailing List                                                
             <[email protected]                                             
               rospect.com>                                                
                                                                           
                                                                           




If you have a some Cisco stuff you could just SPAN everything to one RJ45
port
and attach a Snort box at the other end (on e.g. a 1Gb NIC).

             Michel

On Friday 12 December 2003 01:05, Michel Blomgren wrote:
> I would say:  Don't trust your firewall(s)!
>
> Placing a Honeypot and/or IDS in *both* the DMZ and the internal network
is
> what I would recommend.  At the few companies I've been at, there has
> always been some kind of trust relationship between the DMZ and the
> internal network, for example, two NICs in each server, one frontend
> (belongs to the DMZ) and one backend (private IPs).  I guess this is the
> typical design of ISPs, but not a very good one if a server in the DMZ is
> rooted, then the attacker could proceed its attacks through eth1
(backend)
> and s/he would also know some of the private net's IP-range(s), a good
> starting point for cracking the internal net.  The internal net's
firewall
> might even have softer rules (or no rules at all) for traffic coming from
> the DMZ backend.
>
> Catching an attacker in the DMZ and *not* in the internal net must be
> bliss!
>
> :)
>
> Then there's always the possibility of an attacker getting past the
> firewall (i.e. both the outside fw and the one protecting the internal
net,
> if that's the network design). Some attacker finds some remote execution
> exploit on the other side of the firewall (e.g. through spoofing your
> backend IPs), auto-executing a client software that connects to a
listening
> agent on the attacker's host, totally circumventing the firewall). Or, of
> course, man-in-the-middle spoofs, like the one described (perhaps
made-up)
> by Shimomura of Mitnick's IP sequence number prediction attack (which, of
> course, is not possible with modern TCP stacks, e.g. RFC1948).
>
> This is all very complex and hard to do!  ...but not impossible!
>
> A Honeypot in the DMZ would possibly give the attacker too many "choices"
> of hosts and that would slow the attacker down. Deploying decoys like
> Honeypots is not real security, but getting alerts and logs of
connections
> to the Honeypots are good warning signals that someone's doing something.
>
> The IDS (Snort) should definitely sniff the entire DMZ (fontends and
> backends), but has to be configured to filter out the usual traffic,
> otherwise the alerts would pile up and real-world cracks would be hard to
> find in all that data.  An IDS should also be placed in the internal
> network.
>
> Then again, me myself don't apply all the paranoia I speak.  I even run
> vulnerable versions of Sendmail and OpenSSL on sentinix.org's server, and
I
> do have the frontend/backend network model here.  :-P
>
>            Michel
>
> On Thursday 11 December 2003 21:01, BWhittaker-i6UbuDaRlKRWk0Htik3J/[email protected] wrote:
> > Keeping in mind that a honey pot can attract  I would not want it on
the
> > inside.
> >
> >
> >
> >
> >
> >
> > Marlon.Richards-5I9FqcT3+DFWk0Htik3J/[email protected]
> > Sent by: sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org
> > 12/11/2003 02:13 PM
> > Please respond to The SENTINIX Mailing List
> >
> >         To:     The SENTINIX Mailing List <[email protected]>
> >         cc:
> >         Subject:        Re: [sentinix-list] Webmin + Honeyd
> >
> >
> >
> >
> >
> >
> >
> > Is it good to have the honeypot in the DMZ or should it be before the
> > firewall?
> >
> >
> >
> >
> >
> > ====================================
> > Marlon Richards
> > Communications Engineer
> > West Indies Alumina Company
> > Kirkvine Works
> > Jamaica
> > Tel#:    876-961-7434
> > Fax#:   876-961-7464
> > Email:  marlon.richards-Rzeo2xivIqhWk0Htik3J/[email protected]
> >
> >
> >
> >
> >              Michel Blomgren
> >              <[email protected]
> >              org>
> > To
> >
> >              Sent by:                  The SENTINIX Mailing List
> >              sentinix-bounces@         <[email protected]>
> >              elevenprospect.co
> > cc
> >
> >              m
> >
> > Subject
> >
> >                                        Re: [sentinix-list] Webmin +
> > Honeyd
> >
> >              12/09/2003 09:56
> >              AM
> >
> >
> >              Please respond to
> >                The SENTINIX
> >                Mailing List
> >              <[email protected]
> >                rospect.com>
> >
> > On Tuesday 09 December 2003 11:04, Hugo Teso Torío wrote:
> > > Hi,
> > >
> > > have been 3 days of holidays in spain and I have been busy with my
> >
> > "dear"
> >
> > > computer, because It has been "death" for three days too. Interesting
> > > weekend...
> >
> > oh, I know the feeling... :(
> >
> > > The webmin implementation for sentinix continues by the correct way
and
> > > also I have installed honeyd on my Sentinix box. Honeyd is an open
> >
> > source
> >
> > > Honeypot for *NIX computers and I thought It woluld be the best
choice
> >
> > for
> >
> > > includibg a Honeypot in Sentinix; the requirements for installing it
> > > are just three libraries:
> > >
> > > a.. libevent - an asynchronous event library.
> > > b.. libdnet - the [not so] dumb network library.
> > > c.. libpcap - a packet capture library.
> > >
> > > the first one comes with Sentinix but the other two must be included
> > > (Michel??) ;-)
> >
> > libpcap is included in SENTINIX (under tcpdump).
> > Yes, I'll put 'em in the source tree. :)
> >
> > > Please, can anybody take a look to the license It is
> > > released? I don't know if can include It in sentinix or there is any
> >
> > legal
> >
> > > problem, thanks.
> >
> > libpcap, libevent and libdnet are put under the revised BSD license.
> > Honeyd
> >
> > has the original BSD license with the nasty advertising clause:
> >
> >  * 3. All advertising materials mentioning features or use of this
> > software
> >  *    must display the following acknowledgement:
> >  *      This product includes software developed by Niels Provos.
> >
> > ...which we'll have to put somewhere in some obscure place, in tiny
> > writing
> > in
> > the technical documentation (like Microsoft do with the IP stack).  If
we
> > mention use of Honeyd on the front web page, I simply refuse to put the
> > acknowledgement there, since then I would feel obligated to put every
> > other
> >
> > software creator's name in there too, which would be a very long list
no
> > one
> > would read anyway... better to reference and credit the entire project
> > directly instead, which the author would probably not object too either
> > (hopefully :).
> >
> > > think in two or three weeks I will finish with webmin and honeyd,
> >
> > depending
> >
> > > on my computer's health
> >
> > Great!
> >
> > > Please take a look to the pdf about the do_brk bug for linux kernel;
> > > has been pached for higher kernels than the 2.4.22 and there is also
a
> > > pach
> >
> > in
> >
> > > buqtraq, but It's an interesting paper to read.
> >
> > Yes, I have read the iSEC report.  I even tested their little exploit
> > code,
> >
> > which, as expected, didn't work no matter how much I altered the code.
> > Anyway, 2.4.21 will still stay as openMosix kernel in the next release,
> > but
> >
> > with the do_brk() bug fixed.
> >
> >              Michel
> > _______________________________________________
> > SENTINIX mailing list
> > [email protected]
> > http://elevenprospect.com/mailman/listinfo/sentinix
> >
> >
> > _______________________________________________
> > SENTINIX mailing list
> > [email protected]
> > http://elevenprospect.com/mailman/listinfo/sentinix
> >
> >
> >
> >
> >
> >
> > _______________________________________________
> > SENTINIX mailing list
> > [email protected]
> > http://elevenprospect.com/mailman/listinfo/sentinix
>
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix
_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix